@ai-ecoverse/slicc-kernel 1.136.7 → 1.137.0

package/dist/node-process-worker.js

@@ -6699,7 +6699,7 @@ var KERNEL_VERSION, OS_RELEASE;
 var init_version = __esm({
   "src/version.ts"() {
     "use strict";
-    KERNEL_VERSION = true ? "1.136.7" : "0.0.0-dev";
+    KERNEL_VERSION = true ? "1.137.0" : "0.0.0-dev";
     OS_RELEASE = "6.0.0-slicc";
   }
 });
@@ -7784,6 +7784,20 @@ var init_js_net = __esm({
   }
 });
 
+// src/kernel/proc-info.ts
+function mayTrace(viewer, target) {
+  const by = viewer?.cred;
+  const of = target.cred;
+  if (!by || !of || by.euid === 0) return true;
+  const uid = of.ruid === by.euid && of.euid === by.euid && of.suid === by.euid;
+  return uid && of.rgid === by.egid && of.egid === by.egid && of.sgid === by.egid;
+}
+var init_proc_info = __esm({
+  "src/kernel/proc-info.ts"() {
+    "use strict";
+  }
+});
+
 // src/fs/owners.ts
 function inGroup(cred, gid) {
   return cred.egid === gid || cred.groups.includes(gid);
@@ -10619,6 +10633,25 @@ function attr(node) {
     blocks: 0
   };
 }
+function withPidFiles(names, extra) {
+  return [.../* @__PURE__ */ new Set([...names, ...PID_FILES, ...extra])];
+}
+function exeNodes(fresh, info, error, self) {
+  return {
+    exeLink: (parent, target, own = false) => {
+      const of = info(target, own);
+      const exe = of?.exe;
+      if (!of || exe === void 0) throw error();
+      const link = fresh(parent, "exe", LINK_MODE2);
+      link.node_ops.readlink = () => {
+        if (!mayTrace(info(self, true), of)) throw error(EACCES);
+        return exe;
+      };
+      return link;
+    },
+    hasExe: (target, own = false) => info(target, own)?.exe === void 0 ? [] : ["exe"]
+  };
+}
 function useProcfs(Fs, sys, pid, memory = memorySource()) {
   const { lookupPath, createNode, hashRemoveNode } = Fs;
   const procList = sys.procList?.bind(sys);
@@ -10685,14 +10718,16 @@ function useProcfs(Fs, sys, pid, memory = memorySource()) {
     dir.node_ops.readdir = () => [".", "..", ...Object.keys(tree)];
     return dir;
   };
-  const pidNames = (names) => [.../* @__PURE__ */ new Set([...names, ...PID_FILES])];
+  const exe = exeNodes(fresh, (at, own) => find(procList().processes, at, own), error, pid);
+  const pidNames = (names) => withPidFiles(names, exe.hasExe(pid, true));
   const pidDir = (name2, target) => {
     const dir = fresh(proc, name2, DIR_MODE2);
     dir.node_ops.lookup = (parent, child) => {
+      if (child === "exe") return exe.exeLink(parent, target);
       if (!PID_FILES.includes(child)) throw error();
       return file(parent, child, pidContent(target, child));
     };
-    dir.node_ops.readdir = () => [".", "..", ...PID_FILES];
+    dir.node_ops.readdir = () => [".", "..", ...PID_FILES, ...exe.hasExe(target)];
     return dir;
   };
   const scans = /* @__PURE__ */ new Map();
@@ -10776,6 +10811,7 @@ function useProcfs(Fs, sys, pid, memory = memorySource()) {
   self.node_ops = {
     ...selfOps,
     lookup: (parent, name2) => {
+      if (name2 === "exe") return exe.exeLink(parent, pid, true);
       if (PID_FILES.includes(name2)) {
         return file(parent, name2, pidContent(pid, name2, true));
       }
@@ -10785,11 +10821,12 @@ function useProcfs(Fs, sys, pid, memory = memorySource()) {
     readdir: (node) => pidNames(selfReaddir ? selfReaddir(node) : [".", ".."])
   };
 }
-var HZ, DIR_MODE2, FILE_MODE, LINK_MODE2, ENOENT, EINVAL, UID2, KIB, FALLBACK_MEMORY, PID_FILES, SYSTEM_FILES, SYS_TREE, sigMask, STATES, tagLine;
+var HZ, DIR_MODE2, FILE_MODE, LINK_MODE2, ENOENT, EINVAL, EACCES, UID2, KIB, FALLBACK_MEMORY, PID_FILES, SYSTEM_FILES, SYS_TREE, sigMask, STATES, tagLine;
 var init_procfs = __esm({
   "src/process/procfs.ts"() {
     "use strict";
     init_cred();
+    init_proc_info();
     init_version();
     init_process_fds();
     HZ = 100;
@@ -10798,6 +10835,7 @@ var init_procfs = __esm({
     LINK_MODE2 = 41471;
     ENOENT = 44;
     EINVAL = 28;
+    EACCES = 2;
     UID2 = 1e3;
     KIB = 1024;
     FALLBACK_MEMORY = 4 * KIB * KIB * KIB;
@@ -11096,6 +11134,7 @@ var DIR_MODE3, FILE_MODE2, LINK_MODE3, PID_NAMES, SYSTEM_NAMES, ProcTree, FOLLOW
 var init_wasi_procfs = __esm({
   "src/process/wasi/wasi-procfs.ts"() {
     "use strict";
+    init_proc_info();
     init_sync_fs_wire();
     init_process_fds();
     init_procfs();
@@ -11156,7 +11195,16 @@ var init_wasi_procfs = __esm({
         if (!/^[1-9]\d*$/.test(top) || !this.alive(Number(top))) return void 0;
         if (leaf === "task") return this.task(Number(top), rest2);
         if (rest2.length > 0) return void 0;
-        if (leaf === void 0) return { kind: "dir", names: () => [...PID_NAMES, "task"] };
+        if (leaf === void 0) {
+          const exe = () => this.info(Number(top))?.exe === void 0 ? [] : ["exe"];
+          return { kind: "dir", names: () => [...PID_NAMES, ...exe(), "task"] };
+        }
+        if (leaf === "exe") {
+          const info = this.info(Number(top));
+          if (info?.exe === void 0) return void 0;
+          const denied = !mayTrace(this.ownInfo(), info);
+          return { kind: "link", target: info.exe, ...denied ? { denied } : {} };
+        }
         if (!PID_NAMES.includes(leaf)) return void 0;
         return {
           kind: "file",
@@ -11168,6 +11216,10 @@ var init_wasi_procfs = __esm({
           }
         };
       }
+      ownInfo() {
+        const processes2 = this.listing().processes;
+        return processes2.find((p) => p.tid === this.pid) ?? processes2.find((p) => p.pid === this.pid);
+      }
       info(pid) {
         return this.listing().processes.find((p) => p.pid === pid);
       }
@@ -11231,6 +11283,7 @@ var init_wasi_procfs = __esm({
       readlink(path) {
         const node = this.find(path, false);
         if (node.kind !== "link") throw syncError("EINVAL", path);
+        if (node.denied) throw syncError("EACCES", path);
         return node.target;
       }
       exists(path) {
@@ -13843,11 +13896,19 @@ function identify(transport, init) {
 function liveParent(imports, parent, glue) {
   wrapImport(imports, "getppid", glue, () => parent);
 }
-function signalMasks(m) {
+function seedInherited(transport, seeded) {
+  const bits = inheritedSignals(transport);
+  seeded.bits |= bits;
+  return bits;
+}
+function signalMasks(m, seeded = { bits: 0 }) {
   const mask = m.sliccSigMask;
   const caught = mask?.(0) ?? -1;
   if (!mask || caught === -1) return null;
-  return { caught, ignored: mask(1), restart: mask(2) };
+  const ignored = mask(1);
+  const defaults = seeded.bits & ~ignored & ~caught;
+  seeded.bits &= ~defaults;
+  return { caught, ignored, restart: mask(2), ...defaults ? { defaults } : {} };
 }
 function reportGrowth(imports, publish, glue) {
   wrapImport(imports, "resizeHeap", glue, (resize) => (...args) => {
@@ -13951,13 +14012,12 @@ function sigpipeSpared(transport) {
   return r.ok && !(r.kind === "json" && r.json === "terminate");
 }
 async function runWasmProcess(init, port3, deps = {}) {
+  const seeded = { bits: 0 };
   const signals = new SignalGate(
-    createSyncSabTransport(init.sab, port3, {
-      memory: () => memory?.buffer.byteLength ?? 0
-    }),
+    createSyncSabTransport(init.sab, port3, { memory: () => memory?.buffer.byteLength ?? 0 }),
     new Int32Array(init.sab, 0, SAB_HEADER_I32),
     {
-      masks: () => signalMasks(module),
+      masks: () => signalMasks(module, seeded),
       raise: (sig) => module.sliccRaise?.(sig),
       timer: (which) => {
         const running2 = module;
@@ -13990,7 +14050,7 @@ async function runWasmProcess(init, port3, deps = {}) {
     sliccPid: id.pid,
     sliccPpid: id.ppid,
     sliccEnv: init.env,
-    sliccKernel: { sigInherited: () => inheritedSignals(transport) },
+    sliccKernel: { sigInherited: () => seedInherited(transport, seeded) },
     print: say(1),
     printErr: say(2),
     instantiateWasm(imports, done) {